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REMARKS/ARGUMENTS 

In view of the amendments and remarks herein, favorable reconsideration and allowance 
of this application are respectfully requested. By this Amendment, claim 1 is amended. Thus, 
claims 1-12 are pending for further examination. 

Claims 1-4, 6-9, and 1 1 have been rejected under 35 USC 103 as allegedly being obvious 
over Bunch (U.S. Patent No. 6,795,856) in view of Campbell et al. (U.S. Publication No. 
2003/0009464). Claims 5, 10, and 12 also have been rejected under 35 USC 103(a) as allegedly 
being obvious over Bunch in view of Campbell. Without acquiescing to the propriety of the 
rejections, Applicant has amended the claims to more clearly distinguish the invention defined 
by the claims from the prior art of record. Thus, reconsideration and withdrawal of these 
rejections are respectfully requested. 
Deficiencies with Respect to Bunch 

For a claim to be properly rejected under 35 USC 103, each and every limitation of that 
claim must be taught or suggested in a combination of references. Bunch and Campbell, alone 
and in combination, do not disclose all of the limitations of claim 1 . For example, Bunch and 
Campbell, alone and in combination, fail to teach or suggest "importing firewall log files 
generated by a centrally located firewall to a database to generate master activity files, wherein 
the firewall log files provide information on activities attempting to pass through the firewall 
from and to a company computer, and wherein the master activity files include data on Internet 
usage, e-mail usage, and dial-in connections." 

Bunch appears to disclose a system that utilizes a client-based module that monitors 
Internet access, which operates in conjunction with an enforcement supervisor located on a 
remote web server (or, in an alternate embodiment, on a server in a company's LAN). Of critical 
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importance to the techniques disclosed in Bunch is that "a client-based monitoring module 
performs all of the monitoring and logging activity" (abstract; see also col. 3, lines 14-15; col. 5, 
lines 61-65). This client-side monitoring system is part of each personal computer system in the 
company's network (Figs. 1 and 2) - indeed, "[e]ach personal computer system has one client- 
side module that is less than one megabyte in size" (col. 5, lines 46-48), which performs "all the 
monitoring and logging work, [and] is responsible for intercepting universal resource link 
[(URL)] requests between an Internet browser and a network programming interface" (col. 5, 
lines 61-65). The intercepting is made possible through hook interface 40, which interacts with 
browser 36, as a part of personal computer system 12 (Fig. 3; col. 6, lines 24-67), or via direct 
modification to browsers. 

Furthermore, Bunch explicitly disclaims any centralized filtering or supervising, instead 
requiring the above-noted client-side monitoring mechanism: 

In accordance with the present invention, a central filter and centralized enforcement 
supervisor are not used. Instead, the present invention provides a client side mechanism 
for tracking Internet usage on a time-spent-per-web-page basis within a browser such as 
Microsoft Internet explorer and transmitting this information to a remote web-site . . . 
where authorized personnel can access can access the information over the Internet 

(col 3, lines 17-24). Almost identical language is included throughout the specification {see, e.g., 

col. 4, lines 21-29). Bunch's techniques work only with computers on which special client-based 

software is installed. Applicant notes that the Office Action mischaracterizes Bunch when it 

asserts that Bunch teaches that the system can alternatively be used in a server-based capacity. 

Indeed, the portion cited in the Office Action notes that the "web-side Internet access monitoring 

supervisor module 32 [can be] located on the server 22" (col. 5, lines 30-31). This argument is 

inapposite to the claimed invention because it relates to where the supervisor module resides, not 

where firewall log files are created. Differently stated, this portion of Bunch indicates that the 
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mechanism by which administrators can view reports may be located in various different 
locations. But Bunch still requires the actual monitoring to be performed by modules located on 
the computer. 

The claimed invention, however, gathers similar information by using a company's 
firewall to directly build firewall log files. In sum, then, whereas Bunch's invention requires 
client-based software to perform monitoring functions, the invention defined by the claims 
instead requires that "firewall log files [be] generated by a centrally located firewall." This 
difference is especially apparent because Bunch disclaims this kind of central monitoring and 
enforcement mechanism. 

One of Ordinary Skill in the Art Would Not Combine Bunch and Campbell 

Campbell was introduced to make up for this deficiency with respect to Bunch. For a 
claim to be properly rejected based on a combination of references, there must be, inter alia, 
some suggestion or motivation, either in the references themselves or in the knowledge generally 
available to one of ordinary skill in the art, to modify the reference or to combine reference 
teachings. See MPEP 2143. Moreover, even though references can be combined does not mean 
that the references should be combined in the manner alleged. See In re Mills, 916 F.2d 680, 16 
USPQ2d 1430 (Fed. Cir. 1990). 

Applicant respectfully submits that one of ordinary skill in the art would not combine the 
references in the manner alleged in the Office Action. The background of Bunch teaches that it 
is disadvantageous to gather information from a central source using filters and firewalls. Bunch 
teaches that client-based monitoring modules are advantageous because they can be easily 
customized by administrators, impose little performance penalties, and require little expertise 
during setup. And, as noted above, Bunch explicitly disclaims centrally located monitoring 
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modules. In sum, then, Bunch is directed to client-based monitoring of Internet access and 
teaches away from using any monitoring mechanism other than a client-based module. To the 
contrary, Campbell teaches that it is advantageous to "obtain network activity data from a variety 
of data sources such as firewalls, routers, servers, PBXs, softswitches, media gateways, SS7 
signaling points, integrated access devices, and calling card imports" (abstract; see also page 1-2, 
paragraph [0012]). 

These conflicting teachings of Bunch and Campbell would change the principles of 
operation of both Bunch and Campbell. Cf In re Ratti, 270 F.2d 810, 123 USPQ 349 (CCPA 
1959) (refusing to find obviousness where a combination of references would change the 
principle of operation of prior art). Combining the references in the manner alleged would result 
in a system that generated data from a client-based module and a firewall. This alleged 
combination conflicts with the principles of operation of Bunch, because Bunch is directed to 
gathering data only via client-based modules and explicitly disclaims gathering data from a 
central source (e.g. a firewall). This alleged combination also conflicts with the principles of 
operation of Campbell because Campbell is directed to gathering data from any or all sources 
available whereas Bunch is directed to the client-based gathering of data only. In either case, the 
alleged combination would fundamentally change the principles of operation of the prior art. 

With regard to the specific motivation to combine the references recited in the Office 
Action, for Bunch it is unnecessary "to identify every resource that could be used to access 
internet websites" as alleged by the Office Action. To do so would be to abandon Bunch's 
client-based approach and to gather extraneous information, because Bunch is directed to 
monitoring traffic originating with company computers and traffic associated with the remote use 
of company computers. Thus, the clear teachings of Bunch conflict with the motivation alleged 
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in the Office Action, especially when read with Bunch's disclaimer of central monitoring. For at 
least the foregoing reasons, Applicant respectfully submits that one of ordinary skill in the art 
would not have combined the references in the manner alleged. 

Combining the References Still Would Not Render the Claimed Invention Obvious 

Even if the references were combined in the manner alleged, the combination still would 
not disclose each and every limitation of the claimed invention. For example, while Bunch 
appears to suggest that log files may be drawn from firewalls, it does not disclose that the 
"firewall log files provide information on activities attempting to pass through the firewall from 
and to a company computer" as required by claim 1 . This is because Campbell is directed more 
towards tracking ownership of resources within an organization, especially as employees join, 
leave, or move around within an organization. Thus, while Campbell does appear to suggest that 
source and target IP address may be recorded, for example, the source addresses seem only to 
correspond to network resources (i.e. those resources that are incorporated into the organization's 
LAN and/or WAN). Indeed, Fig. 3C shows only GET operations, Fig. 3D shows only sent 
emails, and Fig. 4 shows only outgoing processed output As such, even if firewall log files that 
provided information on activities attempting to pass through the firewall from a company 
computer were captured and recorded, there is absolutely no teaching or suggestion in Campbell 
(or Bunch, which, as noted above, views monitoring via firewalls as a disadvantageous 
technique) that such firewall log files would additionally include information on activities 
attempting to pass through the firewall to a company computer. 
Conclusion 

For at least the foregoing reasons, Applicant respectfully submits that amended claim 1 is 
not rendered obvious by the cited references. Moreover, Applicant respectfully submits that 
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dependent claims 2-4, 6-9, and 1 1 are allowable at least by virtue of their dependence on 
allowable, amended independent claim 1. Applicant also respectfully submits that dependent 
claims 5, 10, and 12 are allowable for substantially the same reasons as those set forth above. 

In view of the foregoing remarks, Applicant believes that all of the pending claims 
clearly and patentably distinguish the prior art of record and are in condition for allowance. 
Thus, withdrawal of the rejection and passage of this case to issuance at an early date are 
earnestly solicited. 

Should the Examiner have any questions, or deem that any further issues need to be 
addressed prior to allowance, the Examiner is invited to call the undersigned attorney at the 
phone number below. 



JSP:jr 

901 North Glebe Road, 1 1th Floor 
Arlington, VA 22203-1808 
Telephone: (703)816-4000 
Facsimile: (703) 816-4100 



Respectfully submitted, 



NIXON & VANDERHYE P.C. 




Reg. No. 35,329 



-10- 



1113095 



